Landing Recent QUIC changes until 2016-07-02 02:45 UTC

net/quic/crypto/quic_crypto_client_config.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/crypto/quic_crypto_client_config.h"
 
 #include <memory>
 
 #include "base/metrics/histogram_macros.h"
 #include "base/stl_util.h"
@@ skipping 395 matching lines @@
        it != cached_states_.end(); ++it) {
     it->second->Clear();
   }
 }
 
 void QuicCryptoClientConfig::FillInchoateClientHello(
     const QuicServerId& server_id,
     const QuicVersion preferred_version,
     const CachedState* cached,
     QuicRandom* rand,
+    bool demand_x509_proof,
     QuicCryptoNegotiatedParameters* out_params,
     CryptoHandshakeMessage* out) const {
   out->set_tag(kCHLO);
   out->set_minimum_size(kClientHelloMinimumSize);
 
   // Server name indication. We only send SNI if it's a valid domain name, as
   // per the spec.
   if (CryptoUtils::IsValidSNI(server_id.host())) {
     out->SetStringPiece(kSNI, server_id.host());
   }
   out->SetValue(kVER, QuicVersionToQuicTag(preferred_version));
 
   if (!user_agent_id_.empty()) {
     out->SetStringPiece(kUAID, user_agent_id_);
   }
 
-  char proof_nonce[32];
-  rand->RandBytes(proof_nonce, arraysize(proof_nonce));
-  out->SetStringPiece(kNONP, StringPiece(proof_nonce, arraysize(proof_nonce)));
-
   // Even though this is an inchoate CHLO, send the SCID so that
   // the STK can be validated by the server.
   const CryptoHandshakeMessage* scfg = cached->GetServerConfig();
   if (scfg != nullptr) {
     StringPiece scid;
     if (scfg->GetStringPiece(kSCID, &scid)) {
       out->SetStringPiece(kSCID, scid);
     }
   }
 
   if (!cached->source_address_token().empty()) {
     out->SetStringPiece(kSourceAddressTokenTag, cached->source_address_token());
   }
 
+  if (!demand_x509_proof) {
+    return;
+  }
+
+  char proof_nonce[32];
+  rand->RandBytes(proof_nonce, arraysize(proof_nonce));
+  out->SetStringPiece(kNONP, StringPiece(proof_nonce, arraysize(proof_nonce)));
+
   if (disable_ecdsa_) {
     out->SetVector(kPDMD, QuicTagVector{kX59R});
   } else {
     out->SetVector(kPDMD, QuicTagVector{kX509});
   }
 
   if (common_cert_sets) {
     out->SetStringPiece(kCCS, common_cert_sets->GetCommonHashes());
   }
 
@@ skipping 26 matching lines @@
     const CachedState* cached,
     QuicWallTime now,
     QuicRandom* rand,
     const ChannelIDKey* channel_id_key,
     QuicCryptoNegotiatedParameters* out_params,
     CryptoHandshakeMessage* out,
     string* error_details) const {
   DCHECK(error_details != nullptr);
 
   FillInchoateClientHello(server_id, preferred_version, cached, rand,
-                          out_params, out);
+                          /* demand_x509_proof= */ true, out_params, out);
 
   const CryptoHandshakeMessage* scfg = cached->GetServerConfig();
   if (!scfg) {
     // This should never happen as our caller should have checked
     // cached->IsComplete() before calling this function.
     *error_details = "Handshake not ready";
     return QUIC_CRYPTO_INTERNAL_ERROR;
   }
 
   StringPiece scid;
@@ skipping 480 matching lines @@
   }
 
   // Update canonical version to point at the "most recent" entry.
   canonical_server_map_[suffix_server_id] = server_id;
 
   server_state->InitializeFrom(*canonical_state);
   return true;
 }
 
 }  // namespace net